> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/use-context-data-in-a-playbook.md).

# Use context data in a playbook

In Cortex XDR you can use context data (from an issue or case) in playbooks, and you can use playbook tasks to update context data. You can:

* Use the information stored in the issue context data as task inputs and outputs in a playbook.
  * To access data that is stored in the issue context data, use the keyword `issue`.

    Example 43.

    To access a the `status` value in the issue context data, use the following syntax:

    ```programlisting
    ${issue.status}
    ```
  * To access data that is stored in the parent case context data, use the keyword `parentIncidentContext`.

    Example 44.

    To access the `hostname` value in the case context data, use the following syntax:

    ```programlisting
    ${parentIncidentContext.hostname}
    ```
* Set a breakpoint in a playbook that reviews context data after a specific task.

  This is available when using the debugger. As context data may be updated during a playbook run, setting a breakpoint enables you to pause the playbook execution, review the context data, and take action if necessary. Breakpoints can be useful when designing and troubleshooting playbooks. For more information, see [Test your playbook](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/build-your-playbook/test-your-playbook.md).
* Add a task that writes playbook data to the case context.

  When you add data to the case context, you can use this data to run playbooks on any of the issues that are included in the case.

  To write playbook data to the case context, use the `setParentIncidentContext` script in a standard task. For more information, see [Add context data to a case](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/add-context-data-to-a-case.md).

  <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><h3>Caution</h3><p>Users with Trigger Playbook permissions on a given issue may still be able to modify the parent case via commands and scripts, even without full access to the case.</p></div>

For more information about playbooks, see [Playbooks overview](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/playbooks/playbooks-overview.md).

**Context data in sub-playbooks**

By default, the context data for sub-playbooks is stored in a separate context key. Consider the following information:

* When a task in a main playbook accesses context data, it does not have direct access to sub-playbook data.
* When a task in a sub-playbook accesses context data, it does not have direct access to the main playbook data.
* If the sub-playbook has been configured to share globally, the sub-playbook context data is available to the main playbook and vice versa.

**Use case: Use context data in a Jira ticketing system**

In this use case, a Jira ticketing system is used to manage issues and reduce duplicate tickets.

**Issue:** When an action is taken on an endpoint, some cases contain multiple issues for the same endpoint. If each issue runs a playbook on the same endpoint, duplicate tickets are created for each case.

**Solution:** This playbook checks existing endpoints and Case IDs and decides whether to create a new ticket or to add the data to an existing ticket, and therefore, reduces duplicate tickets in the case

![](/files/i5vKnzoo6rmQ80cJEBgF)

The playbook flow is described in the following steps:

1. After checking that the Jira v3 integration is enabled, in this task the playbook adds the `EndpointFromAlerts` key to the case context by retrieving the `alert.hostname` and using the `setParentIncidentContext` script\
   ![](/files/S2fylK5KTKES474QBLnO)
2. In this task, the playbook checks if there is an open ticket for the case by retrieving the `parentIncidentContext.TicketID`\
   ![](/files/EoEgObueVXzqKvE1AXbb)
3. If there is no open ticket, a new ticket is created in Jira and the TicketID is added to the case context\
   ![](/files/nBIM9Rtrj9jj3ZN6iDAY)
4. If there is an open ticket, this task checks whether there is an open ticket for the endpoint by comparing the `alert.hostname` (issue endpoint) to the `parentIncidentContent.EndpointFromAlerts` key\
   ![](/files/by4StRa6IhuRVdP41Q8Z)
5. After retrieving the `alert.hostname` in the `parentIncidentContext.EndpointFromAlerts` context, if there is no open ticket for the endpoint, the playbook updates the Jira ticket for the case.

   In this example, you can see that the `EndpointFromAlerts` and `TicketID` has been added to the case context data\
   ![](/files/0q7f84Cgr9QMyWz4Oc5q)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/context-data/use-context-data-in-a-playbook.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.